485abd96257fddf5c22ce467b0284d7336120d9d27f5a1cb6c2f7cd8533e9099

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
K32XbEHN.exe
Size 4.6MB
Sample261002-r5te3svvbw
SHA256 485abd96257fddf5c22ce467b0284d7336120d9d27f5a1cb6c2f7cd8533e9099
MD5 c3727942bb5869a5fe0d2e69d3d8aae6
SHA1 8f2d907729a24e2f97855e8db48a258dafd1c781
SHA512 361c678c04c6487f1388514e06baab466eb106e4ea0706765df68fda72a0a03c3a5bf7da44609b026329a542839f3fec97515195c7fb7923d33e550e45473398
SSDEEP 49152:f6gNaohvoiV7uEyVPA2oeeR1mhOXdJ4tJC6X0BuxEBUy3m3KQXICXpjxub30GZ3c:oo7J1mhOXdJKCPuThYGO30GYRhkcU+d
TLSH
T1E5267B03F26252E8C06AC5B4935AA232F6353C8D432579FF5BD05B212E65FD06B3DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5620	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	K32XbEHN.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 5620	4156	K32XbEHN.exe	90

C:\Users\Admin\AppData\Local\Temp\K32XbEHN.exe
"C:\Users\Admin\AppData\Local\Temp\K32XbEHN.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  - Deletes itself
  PID:5620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5620-0-0x0000025FE75C0000-0x0000025FE75C1000-memory.dmp

Download